CNVD-2022-20694

Vulnerability from cnvd - Published: 2022-03-18
VLAI
Title
WAGO跨站请求伪造漏洞
Description
WAGO是德国万可（WAGO）的一款750-88x系列可编程逻辑控制器。该设备专门为在工业环境下应用而设计的数字运算操作电子系统。 WAGO 750-8212 PFC200 G2 2ETH RS存在安全漏洞，该漏洞源于WAGO 750-8212 PFC200 G2 2ETH RS中带有反射跨站点脚本 (XSS) 漏洞的链式跨站点请求伪造 (CSRF) 导致会话劫持。 目前没有详细的漏洞细节提供。
Severity
中
Patch Name
WAGO跨站请求伪造漏洞的补丁
Patch Description
WAGO是德国万可（WAGO）的一款750-88x系列可编程逻辑控制器。该设备专门为在工业环境下应用而设计的数字运算操作电子系统。 WAGO 750-8212 PFC200 G2 2ETH RS存在安全漏洞，该漏洞源于WAGO 750-8212 PFC200 G2 2ETH RS中带有反射跨站点脚本 (XSS) 漏洞的链式跨站点请求伪造 (CSRF) 导致会话劫持。 目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://www.wago.com/us/

Reference
https://cxsecurity.com/cveshow/CVE-2021-46380/
Impacted products
Name
WAGO 750-8212
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-46380"
    }
  },
  "description": "WAGO\u662f\u5fb7\u56fd\u4e07\u53ef\uff08WAGO\uff09\u7684\u4e00\u6b3e750-88x\u7cfb\u5217\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\u8be5\u8bbe\u5907\u4e13\u95e8\u4e3a\u5728\u5de5\u4e1a\u73af\u5883\u4e0b\u5e94\u7528\u800c\u8bbe\u8ba1\u7684\u6570\u5b57\u8fd0\u7b97\u64cd\u4f5c\u7535\u5b50\u7cfb\u7edf\u3002\n\nWAGO 750-8212 PFC200 G2 2ETH RS\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eWAGO 750-8212 PFC200 G2 2ETH RS\u4e2d\u5e26\u6709\u53cd\u5c04\u8de8\u7ad9\u70b9\u811a\u672c (XSS) \u6f0f\u6d1e\u7684\u94fe\u5f0f\u8de8\u7ad9\u70b9\u8bf7\u6c42\u4f2a\u9020 (CSRF) \u5bfc\u81f4\u4f1a\u8bdd\u52ab\u6301\u3002 \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://www.wago.com/us/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-20694",
  "openTime": "2022-03-18",
  "patchDescription": "WAGO\u662f\u5fb7\u56fd\u4e07\u53ef\uff08WAGO\uff09\u7684\u4e00\u6b3e750-88x\u7cfb\u5217\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\u8be5\u8bbe\u5907\u4e13\u95e8\u4e3a\u5728\u5de5\u4e1a\u73af\u5883\u4e0b\u5e94\u7528\u800c\u8bbe\u8ba1\u7684\u6570\u5b57\u8fd0\u7b97\u64cd\u4f5c\u7535\u5b50\u7cfb\u7edf\u3002\r\n\r\nWAGO 750-8212 PFC200 G2 2ETH RS\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eWAGO 750-8212 PFC200 G2 2ETH RS\u4e2d\u5e26\u6709\u53cd\u5c04\u8de8\u7ad9\u70b9\u811a\u672c (XSS) \u6f0f\u6d1e\u7684\u94fe\u5f0f\u8de8\u7ad9\u70b9\u8bf7\u6c42\u4f2a\u9020 (CSRF) \u5bfc\u81f4\u4f1a\u8bdd\u52ab\u6301\u3002 \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "WAGO\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "WAGO 750-8212"
  },
  "referenceLink": "https://cxsecurity.com/cveshow/CVE-2021-46380/",
  "serverity": "\u4e2d",
  "submitTime": "2022-03-08",
  "title": "WAGO\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.